AZ-900 Practice Test 30 — 15 Questions

Question 1

A company is adopting a landing zone approach in Azure. The governance team wants to automatically provision a standardized environment for each new Azure subscription. The environment must include: a predefined set of Azure Policy assignments (e.g., enforce resource tagging), specific RBAC role assignments for a central operations team, and a baseline resource group containing a storage account with a specific configuration. The team wants to package all these components into a single, versioned object that can be assigned to a management group and updated over time as requirements change. Which Azure governance service should the team use?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Azure Blueprints. Azure Blueprints is the correct service because it is designed to orchestrate the deployment of a repeatable, versioned environment that includes Azure Policy assignments, RBAC role assignments, and resource groups/templates as a single, composable artifact. Unlike Azure Policy alone, Blueprints can package multiple governance components together and assign them to management groups or subscriptions, with versioning support for updates over time.

Answer

Azure Policy

Answer

Azure Management Groups

Answer

Azure Resource Graph

Question 2

A company uses Azure Blueprints to enforce a standard landing zone for all development subscriptions. The blueprint includes a virtual network, subnets, and network security groups. After the blueprint is assigned to a subscription, a development team manually adds a new subnet to the virtual network. The company plans to update the blueprint to add a new network security group rule. When the updated blueprint is published and the assignment is updated, what will happen to the manually added subnet?

Accepted Answer

The manually added subnet will be preserved because blueprints do not manage resources after creation.. Azure Blueprints are designed to establish a desired configuration for a subscription, but they do not actively manage resources after creation. Once a resource is deployed, the blueprint does not enforce ongoing compliance or revert manual changes. Therefore, when the blueprint is updated and reassigned, only resources defined in the blueprint are affected; the manually added subnet remains untouched because it was not part of the blueprint definition.

Answer

The manually added subnet will be removed because the blueprint definition now takes precedence.

Answer

The manually added subnet will be overwritten by the updated blueprint definition.

Answer

The blueprint update will fail because the subnet already exists.

Question 3

A company has multiple subscriptions. They want to apply a policy that denies creation of resources without a specific tag at the top-level management group. Later, they need to allow a specific subscription to create resources without that tag. What should they do?

Accepted Answer

Create an exclusion for that subscription in the policy assignment.. Azure Policy allows you to assign policies at the management group scope, which applies to all child subscriptions. When you need to exempt a specific subscription from a policy effect (like 'Deny'), you can configure an exclusion on the policy assignment at the management group level. This exclusion removes the policy evaluation for that subscription, allowing resources to be created without the required tag.

Answer

Assign a different policy at the subscription level that allows untagged resources.

Answer

Modify the top-level policy to include an exemption.

Answer

Remove the subscription from the management group.

Question 4

A global e-commerce company has deployed its web application in two Azure regions: West US and East US. The company wants to automatically route end users to the region that provides the lowest latency, and if an entire region becomes unavailable, gracefully redirect all traffic to the remaining healthy region. Which Azure service should the company use?

Accepted Answer

Azure Traffic Manager. Azure Traffic Manager is a DNS-based traffic load balancer that routes incoming DNS requests to the endpoint with the lowest latency based on the user's geographic location. It also supports automatic failover: if an entire region becomes unavailable, Traffic Manager detects the endpoint health probe failure and redirects all traffic to the remaining healthy region, meeting the company's requirements.

Answer

Azure Load Balancer

Answer

Azure Application Gateway

Answer

Azure Front Door

Question 5

A manufacturing company traditionally relied on an internal IT team to procure, configure, and install physical servers for each new project. The provisioning process typically took three to four weeks. After migrating to Azure, developers can now provision virtual machines and other resources directly from the Azure portal within minutes without any interaction with the IT team. This capability best represents which characteristic of cloud computing?

Accepted Answer

On-demand self-service. The scenario describes users provisioning virtual machines directly from the Azure portal without IT intervention. This aligns with on-demand self-service, a core cloud characteristic defined by NIST SP 800-145, where a consumer can unilaterally provision computing capabilities as needed automatically without requiring human interaction with each service provider.

Answer

Rapid elasticity

Answer

Measured service

Answer

Resource pooling

Question 6

A company has an Azure subscription with multiple resource groups. The governance team wants to ensure that every new resource created in the subscription automatically receives a 'Department' tag with a default value of 'Finance' if the creator did not specify one. The team wants the tag to be applied without blocking the creation of the resource. Which Azure feature should they use?

Accepted Answer

Azure Policy with the 'Append' effect. Azure Policy with the 'Append' effect is the correct choice because it adds the 'Department' tag with a default value of 'Finance' to a resource during creation or update, without blocking the operation. Unlike 'Deny', which prevents non-compliant resources, 'Append' modifies the resource request to include the missing tag, ensuring compliance without interrupting the creation process.

Answer

Azure Policy with the 'Deny' effect

Answer

Azure Resource Lock

Answer

Azure role-based access control (RBAC) with a custom role

Question 7

A company manages its production workloads in a dedicated Azure subscription under the root management group. The infrastructure team recently created a critical resource group named 'rg-prod-core' that contains networking resources. To prevent accidental deletion of this entire resource group, the team needs a mechanism that blocks delete operations on 'rg-prod-core' while still allowing changes to resources within it. The solution must not affect any other resource groups in the subscription. Which Azure feature should the team apply to 'rg-prod-core'?

Accepted Answer

Apply a resource lock with the 'CanNotDelete' setting to the resource group.. A resource lock with the 'CanNotDelete' setting prevents deletion of the resource group while still allowing read and update operations on resources within it. This lock applies only to the specific resource group scope, so it does not affect any other resource groups in the subscription. This directly meets the requirement to block deletion of 'rg-prod-core' without impacting other groups.

Answer

Assign an Azure Policy with the 'deny' effect at the management group scope to block deletions of any resource group.

Answer

Create a custom RBAC role that explicitly denies the delete action, and assign it to the infrastructure team at the resource group scope.

Answer

Deploy an Azure Blueprint that includes a policy to audit deletions of the resource group.

Question 8

A large enterprise manages multiple Azure subscriptions for different business units. The central governance team wants to deploy a consistent landing zone across all subscriptions. The landing zone must include pre-defined Azure Policy definitions (e.g., allowed locations, allowed VM SKUs), standard RBAC role assignments (e.g., Owner, Contributor for specific security groups), and a predefined resource group structure (e.g., 'Networking', 'Security', 'Workloads'). The team wants a single, versioned artifact that can be assigned to any subscription to apply all these configurations together, with the ability to update the artifact and have changes propagate to existing assignments. Which Azure service should the team use?

Accepted Answer

Azure Blueprints. Azure Blueprints is the correct choice because it is designed to orchestrate the deployment of a consistent environment by packaging together Azure Policy definitions, RBAC role assignments, and resource groups into a single, versioned artifact. When the blueprint is updated and published, existing assignments can be updated to the latest version, ensuring changes propagate across all subscriptions.

Answer

Azure Policy

Answer

Azure Management Groups

Answer

Azure Resource Graph

Question 9

A company wants to enforce that all Azure storage accounts must have encryption enabled. If a storage account is created without encryption, the policy should automatically enable encryption without manual intervention. Which Azure Policy effect should they use?

Accepted Answer

Modify. The Modify effect is correct because it can automatically enable encryption on a storage account that does not have it enabled, without requiring manual intervention. Unlike DeployIfNotExists, which only deploys resources if they don't exist, Modify can alter existing properties (like encryption settings) on the resource itself. This ensures compliance by remediating non-compliant resources in real time or during evaluation cycles.

Answer

Deny

Answer

Audit

Answer

DeployIfNotExists

Question 10

A company requires that all resources deployed in a production Azure subscription must include a 'Department' tag. Resources without this tag must be automatically prevented from being created. Which Azure service should the company use to enforce this requirement?

Accepted Answer

Azure Policy. Azure Policy is the correct service because it allows you to create, assign, and manage policies that enforce specific rules on your Azure resources. In this scenario, you can define a policy that requires the 'Department' tag on all resources, and configure a deny effect to automatically prevent the creation of any resource that does not include this tag. This ensures compliance at the time of resource creation, without manual intervention.

Answer

Azure Blueprints

Answer

Azure Resource Manager

Answer

Azure Cost Management

Question 11

A company uses Azure Policy to enforce governance rules across its Azure subscriptions. The security team wants to ensure that all virtual machines deployed in a subscription must be of an approved size from a predefined list. If a user attempts to deploy a virtual machine with a size not on the list, the deployment must be immediately blocked. Which Azure Policy effect should the company use in the policy definition?

Accepted Answer

Deny. The 'Deny' effect is correct because it actively blocks any deployment that violates the policy rule, such as deploying a virtual machine with a size not on the approved list. This effect evaluates the request during resource creation or update and denies it if the condition is met, ensuring immediate enforcement. In contrast, other effects like 'Audit' only log non-compliant resources without blocking them, which does not meet the security team's requirement to prevent unauthorized VM sizes.

Answer

Audit

Answer

DeployIfNotExists

Answer

Append

Question 12

What is the primary advantage of deploying VMs across multiple Azure Availability Zones instead of a single Availability Set?

Accepted Answer

Protection against datacenter-level failures with a higher SLA (99.99% vs. 99.95%). Azure Availability Zones are physically separate datacenters within an Azure region, each with independent power, cooling, and networking. Deploying VMs across multiple zones protects against a complete datacenter failure, enabling a 99.99% VM-to-VM connectivity SLA. In contrast, an Availability Set protects against hardware failures within a single datacenter (e.g., rack or update domain failures) and offers a 99.95% SLA.

Answer

VMs in different Availability Zones are always cheaper than Availability Sets

Answer

VMs automatically scale in response to demand when placed in Availability Zones

Answer

Availability Zones reduce network latency between VM instances

Question 13

A large enterprise manages Azure subscriptions for three business units: Sales, Research & Development, and Information Technology. Each business unit has its own Azure subscription. The central governance team needs to ensure that a specific set of Azure Policy definitions (e.g., restricting allowed regions to 'East US' only) is applied to all current and future subscriptions belonging to these three business units. The team wants to minimize administrative overhead and ensure that any new subscription created for a business unit automatically inherits the same policies. Which Azure feature should the team use to achieve this goal?

Accepted Answer

Create a management group for each business unit, place the corresponding subscription inside each management group, and assign the policy set to each management group.. Management groups provide a hierarchical structure above subscriptions, allowing Azure Policy assignments to be inherited by all subscriptions within a management group. By placing each business unit's subscription into its own management group and assigning the policy set (initiative) to each management group, the central governance team ensures that any current or future subscription under those management groups automatically inherits the policies, minimizing administrative overhead.

Answer

Assign each policy definition individually to every subscription.

Answer

Create a single resource group at the tenant root level and assign the policy definitions to that resource group.

Answer

Use Azure Blueprints to deploy a new subscription with the policies, then manually move each existing subscription into the blueprint's management group.

Question 14

A company is deploying a web application in Azure. The application consists of an Azure App Service, an Azure SQL Database, and a Storage account. The development team maintains three separate environments: development, test, and production. The team wants to be able to delete all resources associated with a specific environment (e.g., development) in a single action, without affecting the other environments. The solution must also allow applying role-based access control (RBAC) and tags consistently to all resources within each environment. Which Azure component should the team use to achieve these requirements?

Accepted Answer

Azure resource group. An Azure resource group is a logical container that holds related resources for an Azure solution. By placing all resources for a specific environment (e.g., development) into a single resource group, the team can delete the entire environment in one action by deleting the resource group, without affecting other environments. Additionally, RBAC roles and tags applied at the resource group level are inherited by all resources within that group, ensuring consistent governance.

Answer

Azure subscription

Answer

Azure management group

Answer

Azure availability zone

Question 15

A company has 10 Azure subscriptions organized under two management groups: Production and Non-Production. The governance team needs to enforce a policy that all Azure resources must be deployed only in the East US or West US Azure regions. The policy must apply to every subscription under both management groups, including any new subscriptions added in the future, without requiring separate assignments per subscription. Which Azure feature should the team use to achieve this with the least administrative effort?

Accepted Answer

Assign the 'Allowed Locations' Azure Policy definition to the root management group.. Assigning the 'Allowed Locations' Azure Policy definition to the root management group ensures the policy is inherited by all child management groups (Production and Non-Production) and all subscriptions under them, including any new subscriptions added in the future. This approach requires only a single assignment and minimizes administrative effort compared to per-subscription assignments.

Answer

Assign the 'Allowed Locations' Azure Policy definition to each individual subscription.

Answer

Create a custom Azure RBAC role that restricts the region property and assign it to all users.

Answer

Apply an Azure Resource Manager read-only lock to each subscription.